[wiether]

> Security for dev accounts is not a big deal, just give each developer an individual account and set up billing alerts.

If your only focus is spending, yes.

Otherwise, a "not a big deal" dev account can quickly become the door to your whole org for hackers

[cyberax]

It really depends on the way you set it up and use it. Raw EC2 instances are obviously the most dangerous items.

RDS databases, DynamoDB, and S3? Much less so.

[wiether]

> you set it up and use it

That's my point: I'm not the one setting it up and using it, it's the devs using it

And I'm not expecting them to know how to navigate a cloud provider securely.

So it's either setting the dev account with all the required guardrails in place, or using "local cloud" on their computer